New upstream version 1.4.2 upstream/1.4.2

17 files changed, 145 insertions, 50 deletions

diff --git a/libnm-core/Makefile.in b/libnm-core/Makefile.in
index ca804e3c..81190753 100644
--- a/libnm-core/Makefile.in
+++ b/libnm-core/Makefile.in
@@ -104,7 +104,7 @@ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/attributes.m4 \
 	$(top_srcdir)/m4/ax_lib_readline.m4 \
 	$(top_srcdir)/m4/compiler_options.m4 \
-	$(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/gettext.m4 $(top_srcdir)/m4/git-sha-record.m4 \
 	$(top_srcdir)/m4/gnome-code-coverage.m4 \
 	$(top_srcdir)/m4/gtk-doc.m4 $(top_srcdir)/m4/iconv.m4 \
 	$(top_srcdir)/m4/intlmacosx.m4 $(top_srcdir)/m4/intltool.m4 \
diff --git a/libnm-core/crypto.c b/libnm-core/crypto.c
index c27f5c0d..e734f40d 100644
--- a/libnm-core/crypto.c
+++ b/libnm-core/crypto.c
@@ -712,7 +712,7 @@ crypto_verify_private_key_data (const guint8 *data,
 		/* Maybe it's PKCS#8 */
 		tmp = parse_pkcs8_key_file (data, data_len, &is_encrypted, NULL);
 		if (tmp) {
-			if (crypto_verify_pkcs8 (tmp->data, tmp->len, is_encrypted, password, error))
+			if (!password || crypto_verify_pkcs8 (tmp->data, tmp->len, is_encrypted, password, error))
 				format = NM_CRYPTO_FILE_FORMAT_RAW_KEY;
 		} else {
 			char *cipher, *iv;
diff --git a/libnm-core/crypto_gnutls.c b/libnm-core/crypto_gnutls.c
index d09c9379..53a3ba4a 100644
--- a/libnm-core/crypto_gnutls.c
+++ b/libnm-core/crypto_gnutls.c
@@ -394,7 +394,7 @@ crypto_verify_pkcs8 (const guint8 *data,
 
 	if (err < 0) {
 		if (err == GNUTLS_E_UNKNOWN_CIPHER_TYPE) {
-			/* HACK: gnutls doesn't support all the cipher types that openssl
+			/* HACK: gnutls < 3.5.4 doesn't support all the cipher types that openssl
 			 * can use with PKCS#8, so if we encounter one, we have to assume
 			 * the given password works.  gnutls needs to unsuckify, apparently.
 			 * Specifically, by default openssl uses pbeWithMD5AndDES-CBC
diff --git a/libnm-core/nm-connection.c b/libnm-core/nm-connection.c
index f39d41c5..57f96409 100644
--- a/libnm-core/nm-connection.c
+++ b/libnm-core/nm-connection.c
@@ -28,7 +28,6 @@
 #include "nm-connection.h"
 #include "nm-connection-private.h"
 #include "nm-utils.h"
-#include "nm-utils-private.h"
 #include "nm-setting-private.h"
 #include "nm-core-internal.h"
 
@@ -916,7 +915,7 @@ _normalize_team_config (NMConnection *self, GHashTable *parameters)
 	if (s_team) {
 		const char *config = nm_setting_team_get_config (s_team);
 
-		if (config && !_nm_utils_check_valid_json (config, NULL)) {
+		if (config && !*config) {
 			g_object_set (s_team, NM_SETTING_TEAM_CONFIG, NULL, NULL);
 			return TRUE;
 		}
@@ -932,7 +931,7 @@ _normalize_team_port_config (NMConnection *self, GHashTable *parameters)
 	if (s_team_port) {
 		const char *config = nm_setting_team_port_get_config (s_team_port);
 
-		if (config && !_nm_utils_check_valid_json (config, NULL)) {
+		if (config && !*config) {
 			g_object_set (s_team_port, NM_SETTING_TEAM_PORT_CONFIG, NULL, NULL);
 			return TRUE;
 		}
diff --git a/libnm-core/nm-core-internal.h b/libnm-core/nm-core-internal.h
index 94e473d3..e491bce6 100644
--- a/libnm-core/nm-core-internal.h
+++ b/libnm-core/nm-core-internal.h
@@ -326,4 +326,9 @@ gboolean _nm_setting_bond_option_supported (const char *option, NMBondMode mode)
 
 gboolean _nm_utils_inet6_is_token (const struct in6_addr *in6addr);
 
+/***********************************************************/
+
+gboolean    _nm_utils_check_valid_json  (const char *json, GError **error);
+gboolean    _nm_utils_team_config_equal (const char *conf1, const char *conf2, gboolean port);
+
 #endif
diff --git a/libnm-core/nm-keyfile-reader.c b/libnm-core/nm-keyfile-reader.c
index 54a694ef..16f0c225 100644
--- a/libnm-core/nm-keyfile-reader.c
+++ b/libnm-core/nm-keyfile-reader.c
@@ -1167,6 +1167,24 @@ parity_parser (KeyfileReaderInfo *info, NMSetting *setting, const char *key)
 	g_object_set (setting, key, parity, NULL);
 }
 
+static void
+team_config_parser (KeyfileReaderInfo *info, NMSetting *setting, const char *key)
+{
+	const char *setting_name = nm_setting_get_name (setting);
+	gs_free char *conf = NULL;
+	gs_free_error GError *error = NULL;
+
+	conf = nm_keyfile_plugin_kf_get_string (info->keyfile, setting_name, key, NULL);
+	if (conf && conf[0] && !_nm_utils_check_valid_json (conf, &error)) {
+		handle_warn (info, key, NM_KEYFILE_WARN_SEVERITY_WARN,
+		             _("ignoring invalid team configuration: %s"),
+		             error->message);
+		g_clear_pointer (&conf, g_free);
+	}
+
+	g_object_set (G_OBJECT (setting), key, conf, NULL);
+}
+
 typedef struct {
 	const char *setting_name;
 	const char *key;
@@ -1285,6 +1303,14 @@ static KeyParser key_parsers[] = {
 	  NM_SETTING_SERIAL_PARITY,
 	  TRUE,
 	  parity_parser },
+	{ NM_SETTING_TEAM_SETTING_NAME,
+	  NM_SETTING_TEAM_CONFIG,
+	  TRUE,
+	  team_config_parser },
+	{ NM_SETTING_TEAM_PORT_SETTING_NAME,
+	  NM_SETTING_TEAM_CONFIG,
+	  TRUE,
+	  team_config_parser },
 	{ NULL, NULL, FALSE }
 };
 
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index aa9d4619..12dc5a62 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -2915,15 +2915,6 @@ set_cert_prop_helper (const GValue *value, const char *prop_name, GError **error
 	return bytes;
 }
 
-static char *
-_g_value_dup_string_not_empty (const GValue *value)
-{
-	const gchar *str;
-
-	str = g_value_get_string (value);
-	return str && str[0] ? g_strdup (str) : NULL;
-}
-
 static void
 set_property (GObject *object, guint prop_id,
               const GValue *value, GParamSpec *pspec)
@@ -2964,7 +2955,7 @@ set_property (GObject *object, guint prop_id,
 		break;
 	case PROP_SUBJECT_MATCH:
 		g_free (priv->subject_match);
-		priv->subject_match = _g_value_dup_string_not_empty (value);
+		priv->subject_match = nm_strdup_not_empty (g_value_get_string (value));
 		break;
 	case PROP_ALTSUBJECT_MATCHES:
 		g_slist_free_full (priv->altsubject_matches, g_free);
@@ -2972,7 +2963,7 @@ set_property (GObject *object, guint prop_id,
 		break;
 	case PROP_DOMAIN_SUFFIX_MATCH:
 		g_free (priv->domain_suffix_match);
-		priv->domain_suffix_match = _g_value_dup_string_not_empty (value);
+		priv->domain_suffix_match = nm_strdup_not_empty (g_value_get_string (value));
 		break;
 	case PROP_CLIENT_CERT:
 		if (priv->client_cert)
@@ -3018,7 +3009,7 @@ set_property (GObject *object, guint prop_id,
 		break;
 	case PROP_PHASE2_SUBJECT_MATCH:
 		g_free (priv->phase2_subject_match);
-		priv->phase2_subject_match = _g_value_dup_string_not_empty (value);
+		priv->phase2_subject_match = nm_strdup_not_empty (g_value_get_string (value));
 		break;
 	case PROP_PHASE2_ALTSUBJECT_MATCHES:
 		g_slist_free_full (priv->phase2_altsubject_matches, g_free);
@@ -3026,7 +3017,7 @@ set_property (GObject *object, guint prop_id,
 		break;
 	case PROP_PHASE2_DOMAIN_SUFFIX_MATCH:
 		g_free (priv->phase2_domain_suffix_match);
-		priv->phase2_domain_suffix_match = _g_value_dup_string_not_empty (value);
+		priv->phase2_domain_suffix_match = nm_strdup_not_empty (g_value_get_string (value));
 		break;
 	case PROP_PHASE2_CLIENT_CERT:
 		if (priv->phase2_client_cert)
diff --git a/libnm-core/nm-setting-bond.c b/libnm-core/nm-setting-bond.c
index a82d0d79..0364c49d 100644
--- a/libnm-core/nm-setting-bond.c
+++ b/libnm-core/nm-setting-bond.c
@@ -775,13 +775,27 @@ verify (NMSetting *setting, NMConnection *connection, GError **error)
 }
 
 static gboolean
-options_hash_match (NMSettingBond *s_bond, GHashTable *options1, GHashTable *options2)
+options_hash_match (NMSettingBond *s_bond,
+                    GHashTable *options1,
+                    GHashTable *options2,
+                    NMSettingCompareFlags flags)
 {
 	GHashTableIter iter;
 	const char *key, *value, *value2;
 
 	g_hash_table_iter_init (&iter, options1);
 	while (g_hash_table_iter_next (&iter, (gpointer *) &key, (gpointer *) &value)) {
+
+		if (NM_FLAGS_HAS (flags, NM_SETTING_COMPARE_FLAG_INFERRABLE)) {
+			/* when doing an inferrable match, the active-slave should be ignored
+			 * as it might be differ from the setting in the connection.
+			 *
+			 * Also, the fail_over_mac setting can change, see for example
+			 * https://bugzilla.redhat.com/show_bug.cgi?id=1375558#c8 */
+			if (NM_IN_STRSET (key, "fail_over_mac", "active_slave"))
+				continue;
+		}
+
 		value2 = g_hash_table_lookup (options2, key);
 
 		if (!value2) {
@@ -806,10 +820,13 @@ options_hash_match (NMSettingBond *s_bond, GHashTable *options1, GHashTable *opt
 }
 
 static gboolean
-options_equal (NMSettingBond *s_bond, GHashTable *options1, GHashTable *options2)
+options_equal (NMSettingBond *s_bond,
+               GHashTable *options1,
+               GHashTable *options2,
+               NMSettingCompareFlags flags)
 {
-	return    options_hash_match (s_bond, options1, options2)
-	       && options_hash_match (s_bond, options2, options1);
+	return    options_hash_match (s_bond, options1, options2, flags)
+	       && options_hash_match (s_bond, options2, options1, flags);
 }
 
 static gboolean
@@ -823,7 +840,8 @@ compare_property (NMSetting *setting,
 	if (nm_streq0 (prop_spec->name, NM_SETTING_BOND_OPTIONS)) {
 		return options_equal (NM_SETTING_BOND (setting),
 		                      NM_SETTING_BOND_GET_PRIVATE (setting)->options,
-		                      NM_SETTING_BOND_GET_PRIVATE (other)->options);
+		                      NM_SETTING_BOND_GET_PRIVATE (other)->options,
+		                      flags);
 	}
 
 	/* Otherwise chain up to parent to handle generic compare */
diff --git a/libnm-core/nm-setting-team-port.c b/libnm-core/nm-setting-team-port.c
index 0d175d5e..e3ddbdad 100644
--- a/libnm-core/nm-setting-team-port.c
+++ b/libnm-core/nm-setting-team-port.c
@@ -122,13 +122,8 @@ verify (NMSetting *setting, NMConnection *connection, GError **error)
 			                "%s.%s: ",
 			                NM_SETTING_TEAM_PORT_SETTING_NAME,
 			                NM_SETTING_TEAM_PORT_CONFIG);
-			/* for backward compatibility, we accept invalid json and normalize it */
-			if (!priv->config[0]) {
-				/* be more forgiving to "" and let it verify() as valid because
-				 * at least anaconda used to write such configs */
-				return NM_SETTING_VERIFY_NORMALIZABLE;
-			}
-			return NM_SETTING_VERIFY_NORMALIZABLE_ERROR;
+			/* We treat an empty string as no config for compatibility. */
+			return *priv->config ? FALSE : NM_SETTING_VERIFY_NORMALIZABLE;
 		}
 	}
 
diff --git a/libnm-core/nm-setting-team.c b/libnm-core/nm-setting-team.c
index a559e0db..5bf11ed9 100644
--- a/libnm-core/nm-setting-team.c
+++ b/libnm-core/nm-setting-team.c
@@ -94,13 +94,8 @@ verify (NMSetting *setting, NMConnection *connection, GError **error)
 			                "%s.%s: ",
 			                NM_SETTING_TEAM_SETTING_NAME,
 			                NM_SETTING_TEAM_CONFIG);
-			/* for backward compatibility, we accept invalid json and normalize it */
-			if (!priv->config[0]) {
-				/* be more forgiving to "" and let it verify() as valid because
-				 * at least anaconda used to write such configs */
-				return NM_SETTING_VERIFY_NORMALIZABLE;
-			}
-			return NM_SETTING_VERIFY_NORMALIZABLE_ERROR;
+			/* We treat an empty string as no config for compatibility. */
+			return *priv->config ? FALSE : NM_SETTING_VERIFY_NORMALIZABLE;
 		}
 	}
 
diff --git a/libnm-core/nm-utils-private.h b/libnm-core/nm-utils-private.h
index bd54756a..fab38038 100644
--- a/libnm-core/nm-utils-private.h
+++ b/libnm-core/nm-utils-private.h
@@ -31,9 +31,6 @@
 gboolean    _nm_utils_string_slist_validate (GSList *list,
                                              const char **valid_values);
 
-gboolean    _nm_utils_check_valid_json  (const char *json, GError **error);
-gboolean    _nm_utils_team_config_equal (const char *conf1, const char *conf2, gboolean port);
-
 /* D-Bus transform funcs */
 
 GVariant   *_nm_utils_hwaddr_cloned_get (NMSetting     *setting,
diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c
index a31a9190..df75d565 100644
--- a/libnm-core/nm-utils.c
+++ b/libnm-core/nm-utils.c
@@ -3425,7 +3425,22 @@ _nm_utils_hwaddr_cloned_data_synth (NMSetting *setting,
 	              "cloned-mac-address",
 	              &addr,
 	              NULL);
-	return addr ? g_variant_new_string (addr) : NULL;
+
+	/* Before introducing the extended "cloned-mac-address" (and its D-Bus
+	 * field "assigned-mac-address"), libnm's _nm_utils_hwaddr_to_dbus()
+	 * would drop invalid values as it was unable to serialize them.
+	 *
+	 * Now, we would like to send invalid values as "assigned-mac-address"
+	 * over D-Bus and let the server reject them.
+	 *
+	 * However, clients used to set the cloned-mac-address property
+	 * to "" and it just worked as the value was not serialized in
+	 * an ill form.
+	 *
+	 * To preserve that behavior, seralize "" as NULL.
+	 */
+
+	return addr && addr[0] ? g_variant_new_string (addr) : NULL;
 }
 
 gboolean
@@ -3443,7 +3458,7 @@ _nm_utils_hwaddr_cloned_data_set (NMSetting *setting,
 
 	g_object_set (setting,
 	              "cloned-mac-address",
-	              g_variant_get_string (value, NULL),
+	              nm_str_not_empty (g_variant_get_string (value, NULL)),
 	              NULL);
 	return TRUE;
 }
diff --git a/libnm-core/nm-vpn-plugin-info.c b/libnm-core/nm-vpn-plugin-info.c
index a4727619..d3bc4893 100644
--- a/libnm-core/nm-vpn-plugin-info.c
+++ b/libnm-core/nm-vpn-plugin-info.c
@@ -738,7 +738,7 @@ nm_vpn_plugin_info_list_get_service_types (GSList *list,
 			n = _service_type_get_default_abbreviation (priv->service);
 			if (n)
 				g_ptr_array_add (l, g_strdup (n));
-			for (i = 0; priv->aliases[i]; i++) {
+			for (i = 0; priv->aliases && priv->aliases[i]; i++) {
 				n = _service_type_get_default_abbreviation (priv->aliases[i]);
 				if (n)
 					g_ptr_array_add (l, g_strdup (n));
diff --git a/libnm-core/tests/Makefile.in b/libnm-core/tests/Makefile.in
index 75ccb08e..4fbcb07d 100644
--- a/libnm-core/tests/Makefile.in
+++ b/libnm-core/tests/Makefile.in
@@ -100,7 +100,7 @@ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/attributes.m4 \
 	$(top_srcdir)/m4/ax_lib_readline.m4 \
 	$(top_srcdir)/m4/compiler_options.m4 \
-	$(top_srcdir)/m4/gettext.m4 \
+	$(top_srcdir)/m4/gettext.m4 $(top_srcdir)/m4/git-sha-record.m4 \
 	$(top_srcdir)/m4/gnome-code-coverage.m4 \
 	$(top_srcdir)/m4/gtk-doc.m4 $(top_srcdir)/m4/iconv.m4 \
 	$(top_srcdir)/m4/intlmacosx.m4 $(top_srcdir)/m4/intltool.m4 \
diff --git a/libnm-core/tests/test-crypto.c b/libnm-core/tests/test-crypto.c
index 9bab985f..0c2ef48a 100644
--- a/libnm-core/tests/test-crypto.c
+++ b/libnm-core/tests/test-crypto.c
@@ -364,12 +364,11 @@ test_pkcs8 (gconstpointer test_data)
 	password = parts[1];
 
 	test_is_pkcs12 (path, TRUE);
-	test_load_pkcs8 (path, password, -1);
-	/* Until gnutls and NSS grow support for all the ciphers that openssl
-	 * can use with PKCS#8, we can't actually verify the password.  So we
-	 * expect a bad password to work for the time being.
+	/* Note: NSS and gnutls < 3.5.4 don't support all the ciphers that openssl
+	 * can use with PKCS#8 and thus the password can't be actually verified with
+	 * such libraries.
 	 */
-	test_load_pkcs8 (path, "blahblahblah", -1);
+	test_load_pkcs8 (path, password, -1);
 
 	g_free (path);
 	g_strfreev (parts);
diff --git a/libnm-core/tests/test-general.c b/libnm-core/tests/test-general.c
index 6aee2527..f7945071 100644
--- a/libnm-core/tests/test-general.c
+++ b/libnm-core/tests/test-general.c
@@ -5169,6 +5169,8 @@ test_nm_in_set (void)
 
 	_ASSERT (5,  NM_IN_SET_SE (-1, G( 1), G( 2), G( 3), G(-1), G( 5)));
 	_ASSERT (6,  NM_IN_SET_SE (-1, G( 1), G( 2), G( 3), G( 4), G( 5), G(-1)));
+
+	(void) NM_IN_SET ("a",  "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16");
 #undef G
 #undef N
 #undef _ASSERT
@@ -5295,6 +5297,8 @@ test_nm_in_strset (void)
 	_ASSERT (5,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("a"),  N("a")));
 	_ASSERT (6,  NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("e"),  G("a")));
 	_ASSERT (6, !NM_IN_STRSET ("a",  G(NULL), G("b"),  G("c"),  G("d"),  G("e"),  G("f")));
+
+	(void) NM_IN_STRSET ("a",  "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16");
 #undef G
 #undef N
 #undef _ASSERT
diff --git a/libnm-core/tests/test-keyfile.c b/libnm-core/tests/test-keyfile.c
index ecb7cd5a..b9b211b6 100644
--- a/libnm-core/tests/test-keyfile.c
+++ b/libnm-core/tests/test-keyfile.c
@@ -27,6 +27,7 @@
 #include "nm-setting-connection.h"
 #include "nm-setting-wired.h"
 #include "nm-setting-8021x.h"
+#include "nm-setting-team.h"
 
 #include "nm-utils/nm-test-utils.h"
 
@@ -518,6 +519,54 @@ test_8021x_cert_read (void)
 	CLEAR (&con, &keyfile);
 }
 
+static void
+test_team_conf_read_valid (void)
+{
+	GKeyFile *keyfile = NULL;
+	gs_unref_object NMConnection *con = NULL;
+	NMSettingTeam *s_team;
+
+	con = nmtst_create_connection_from_keyfile (
+	      "[connection]\n"
+	      "type=team\n"
+	      "interface-name=nm-team1\n"
+	      "[team]\n"
+	      "config={\"foo\":\"bar\"}",
+	      "/test_team_conf_read/valid", NULL);
+
+	g_assert (con);
+	s_team = nm_connection_get_setting_team (con);
+	g_assert (s_team);
+	g_assert_cmpstr (nm_setting_team_get_config (s_team), ==, "{\"foo\":\"bar\"}");
+
+	CLEAR (&con, &keyfile);
+}
+
+static void
+test_team_conf_read_invalid (void)
+{
+#if WITH_JANSSON
+	GKeyFile *keyfile = NULL;
+	gs_unref_object NMConnection *con = NULL;
+	NMSettingTeam *s_team;
+
+	con = nmtst_create_connection_from_keyfile (
+	      "[connection]\n"
+	      "type=team\n"
+	      "interface-name=nm-team1\n"
+	      "[team]\n"
+	      "config={foobar}",
+	      "/test_team_conf_read/invalid", NULL);
+
+	g_assert (con);
+	s_team = nm_connection_get_setting_team (con);
+	g_assert (s_team);
+	g_assert (nm_setting_team_get_config (s_team) == NULL);
+
+	CLEAR (&con, &keyfile);
+#endif
+}
+
 /******************************************************************************/
 
 NMTST_DEFINE ();
@@ -528,6 +577,8 @@ int main (int argc, char **argv)
 
 	g_test_add_func ("/core/keyfile/test_8021x_cert", test_8021x_cert);
 	g_test_add_func ("/core/keyfile/test_8021x_cert_read", test_8021x_cert_read);
+	g_test_add_func ("/core/keyfile/test_team_conf_read/valid", test_team_conf_read_valid);
+	g_test_add_func ("/core/keyfile/test_team_conf_read/invalid", test_team_conf_read_invalid);
 
 	return g_test_run ();
 }